@oneuptime/common 14.0.8 → 14.0.10

package/Tests/Models/DatabaseModels/TeamComplianceSettingModel.test.ts

@@ -0,0 +1,347 @@
+import Models from "../../../Models/DatabaseModels/Index";
+import AlertSeverity from "../../../Models/DatabaseModels/AlertSeverity";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import IncidentSeverity from "../../../Models/DatabaseModels/IncidentSeverity";
+import TeamComplianceSetting from "../../../Models/DatabaseModels/TeamComplianceSetting";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import { PlanType } from "../../../Types/Billing/SubscriptionPlan";
+import ColumnLength from "../../../Types/Database/ColumnLength";
+import ColumnType from "../../../Types/Database/ColumnType";
+import { TableColumnMetadata } from "../../../Types/Database/TableColumn";
+import TableColumnType from "../../../Types/Database/TableColumnType";
+import { JSONObject } from "../../../Types/JSON";
+import Permission from "../../../Types/Permission";
+import ComplianceNotificationChannel from "../../../Types/Team/ComplianceNotificationChannel";
+import ComplianceRuleType from "../../../Types/Team/ComplianceRuleType";
+import { describe, expect, test } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import type { ColumnMetadataArgs } from "typeorm/metadata-args/ColumnMetadataArgs";
+import type { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs";
+import type { RelationMetadataArgs } from "typeorm/metadata-args/RelationMetadataArgs";
+
+/*
+ * Schema-level guarantees of TeamComplianceSetting after rules gained a
+ * channel and a severity scope.
+ *
+ * None of this is visible to a service or server test - they pass just as
+ * happily against a column the API cannot write, a scope a project viewer can
+ * edit, or a rule table a lapsed licence can still change. So this pins the
+ * three new columns (type, related model, nullability, who may read and
+ * write them), that nothing about the table's gating changed (enterprise
+ * only, the same table permissions, no workflow components), that the unique
+ * (teamId, ruleType) index is gone, and that the API layer turns a posted
+ * severity list into models.
+ */
+
+type ModelType = { new (): BaseModel };
+
+const MODEL_TYPES: Array<ModelType> = Models as Array<ModelType>;
+
+const model: TeamComplianceSetting = new TeamComplianceSetting();
+
+const EDITORS: Array<Permission> = [
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.EditProjectTeam,
+];
+
+const READERS: Array<Permission> = [
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.ProjectMember,
+  Permission.Viewer,
+  Permission.ReadProjectTeam,
+];
+
+// The columns that together say what a rule checks.
+const SCOPE_COLUMNS: Array<string> = [
+  "ruleType",
+  "notificationChannel",
+  "incidentSeverities",
+  "alertSeverities",
+];
+
+type AccessControlForFunction = (
+  column: string,
+) => ColumnAccessControl | undefined;
+
+const accessControlFor: AccessControlForFunction = (
+  column: string,
+): ColumnAccessControl | undefined => {
+  return model.getColumnAccessControlForAllColumns()[column];
+};
+
+type ColumnArgsFunction = (
+  propertyName: string,
+) => ColumnMetadataArgs | undefined;
+
+const columnArgs: ColumnArgsFunction = (
+  propertyName: string,
+): ColumnMetadataArgs | undefined => {
+  return getMetadataArgsStorage().columns.find(
+    (column: ColumnMetadataArgs): boolean => {
+      return (
+        column.target === TeamComplianceSetting &&
+        column.propertyName === propertyName
+      );
+    },
+  );
+};
+
+type RelationArgsFunction = (
+  propertyName: string,
+) => RelationMetadataArgs | undefined;
+
+const relationArgs: RelationArgsFunction = (
+  propertyName: string,
+): RelationMetadataArgs | undefined => {
+  return getMetadataArgsStorage().relations.find(
+    (relation: RelationMetadataArgs): boolean => {
+      return (
+        relation.target === TeamComplianceSetting &&
+        relation.propertyName === propertyName
+      );
+    },
+  );
+};
+
+describe("TeamComplianceSetting - the table", () => {
+  test("is registered, routed and tenant-scoped as before", () => {
+    expect(MODEL_TYPES).toContain(TeamComplianceSetting);
+    expect(model.tableName).toBe("TeamComplianceSetting");
+    expect(model.getCrudApiPath()?.toString()).toBe("/team-compliance-setting");
+    expect(model.getTenantColumn()).toBe("projectId");
+  });
+
+  test("is still an Enterprise-only table", () => {
+    expect(model.requiresEnterprise).toBe(true);
+  });
+
+  test("keeps its billing plans", () => {
+    expect(model.createBillingPlan).toBe(PlanType.Scale);
+    expect(model.readBillingPlan).toBe(PlanType.Free);
+    expect(model.updateBillingPlan).toBe(PlanType.Scale);
+    expect(model.deleteBillingPlan).toBe(PlanType.Free);
+  });
+
+  test("is managed by team editors and readable by every project member", () => {
+    expect(model.getCreatePermissions()).toEqual(EDITORS);
+    expect(model.getUpdatePermissions()).toEqual(EDITORS);
+    expect(model.getDeletePermissions()).toEqual(EDITORS);
+    expect(model.getReadPermissions()).toEqual(READERS);
+  });
+
+  test("is still workflow-inert: annotated, with every trigger off", () => {
+    expect(model.enableWorkflowOn).toEqual({
+      create: false,
+      delete: false,
+      update: false,
+      read: false,
+    });
+  });
+
+  test("has no unique (teamId, ruleType) index any more, and keeps the plain team and project indexes", () => {
+    const indexes: Array<IndexMetadataArgs> =
+      getMetadataArgsStorage().indices.filter(
+        (index: IndexMetadataArgs): boolean => {
+          return index.target === TeamComplianceSetting;
+        },
+      );
+
+    expect(
+      indexes.filter((index: IndexMetadataArgs): boolean => {
+        return Boolean(index.unique);
+      }),
+    ).toEqual([]);
+
+    const indexedColumns: Array<string> = indexes
+      .map((index: IndexMetadataArgs): string => {
+        return JSON.stringify(index.columns);
+      })
+      .sort();
+
+    expect(indexedColumns).toEqual(
+      [JSON.stringify(["projectId"]), JSON.stringify(["teamId"])].sort(),
+    );
+  });
+});
+
+describe("TeamComplianceSetting - the scope columns", () => {
+  test("notificationChannel is optional short text: null means any channel", () => {
+    const metadata: TableColumnMetadata = model.getTableColumnMetadata(
+      "notificationChannel",
+    );
+
+    expect(metadata.type).toBe(TableColumnType.ShortText);
+    expect(metadata.required).toBe(false);
+    expect(metadata.title).toBe("Notification Channel");
+    expect(columnArgs("notificationChannel")?.options).toMatchObject({
+      type: ColumnType.ShortText,
+      length: ColumnLength.ShortText,
+      nullable: true,
+    });
+    expect(columnArgs("notificationChannel")?.options.default).toBeUndefined();
+  });
+
+  test("notificationChannel's API description names every channel it accepts", () => {
+    const description: string =
+      model.getTableColumnMetadata("notificationChannel").description || "";
+
+    for (const channel of Object.values(ComplianceNotificationChannel)) {
+      expect(description).toContain(channel);
+    }
+  });
+
+  test.each([
+    [
+      "incidentSeverities",
+      "IncidentSeverity",
+      IncidentSeverity,
+      "Incident Severities",
+    ],
+    ["alertSeverities", "AlertSeverity", AlertSeverity, "Alert Severities"],
+  ])(
+    "%s is an optional list of %s, stored as a many-to-many relation",
+    (
+      column: string,
+      _relatedName: string,
+      relatedModel: ModelType,
+      title: string,
+    ) => {
+      const metadata: TableColumnMetadata =
+        model.getTableColumnMetadata(column);
+
+      expect(metadata.type).toBe(TableColumnType.EntityArray);
+      expect(metadata.modelType).toBe(relatedModel);
+      expect(metadata.required).toBe(false);
+      expect(metadata.title).toBe(title);
+      expect(metadata.description).toMatch(/Leave empty to require every/);
+
+      const relation: RelationMetadataArgs | undefined = relationArgs(column);
+
+      expect(relation?.relationType).toBe("many-to-many");
+      expect((relation?.type as () => unknown)()).toBe(relatedModel);
+      // Never loaded by accident with every rule read.
+      expect(relation?.options.eager).toBe(false);
+    },
+  );
+
+  test("the severity lists are relations, not columns on the rule row", () => {
+    expect(columnArgs("incidentSeverities")).toBeUndefined();
+    expect(columnArgs("alertSeverities")).toBeUndefined();
+  });
+
+  test.each(SCOPE_COLUMNS)(
+    "%s is written by team editors and read by every project member",
+    (column: string) => {
+      const accessControl: ColumnAccessControl | undefined =
+        accessControlFor(column);
+
+      expect(accessControl?.create).toEqual(EDITORS);
+      expect(accessControl?.update).toEqual(EDITORS);
+      expect(accessControl?.read).toEqual(READERS);
+    },
+  );
+
+  test("whoever may edit any part of a rule may edit all of it", () => {
+    /*
+     * The settings service writes the channel and severity columns when a
+     * rule type changes (clearing what the new type does not use), under the
+     * caller's permissions - so they must be exactly as editable as ruleType.
+     */
+    const ruleTypeAccess: ColumnAccessControl | undefined =
+      accessControlFor("ruleType");
+
+    for (const column of SCOPE_COLUMNS) {
+      expect(accessControlFor(column)).toEqual(ruleTypeAccess);
+    }
+  });
+
+  test("a rule cannot be moved to another team or project", () => {
+    for (const column of ["teamId", "team", "projectId", "project"]) {
+      expect({ column, update: accessControlFor(column)?.update }).toEqual({
+        column,
+        update: [],
+      });
+    }
+  });
+
+  test("ruleType is still required, and a rule is created switched off unless told otherwise", () => {
+    expect(model.getTableColumnMetadata("ruleType").required).toBe(true);
+    expect(columnArgs("ruleType")?.options.nullable).toBe(false);
+
+    expect(model.getTableColumnMetadata("enabled").defaultValue).toBe(false);
+    expect(columnArgs("enabled")?.options.default).toBe(false);
+  });
+});
+
+describe("TeamComplianceSetting - a rule as the API reads and writes it", () => {
+  test("a posted severity list becomes models, and survives the way back", () => {
+    const json: JSONObject = {
+      ruleType: ComplianceRuleType.HasIncidentOnCallRules,
+      notificationChannel: ComplianceNotificationChannel.Call,
+      enabled: true,
+      incidentSeverities: [
+        { _id: "c1c1c1c1-0000-4000-8000-000000000001" },
+        { _id: "c1c1c1c1-0000-4000-8000-000000000002" },
+      ],
+      alertSeverities: [],
+    };
+
+    const setting: TeamComplianceSetting = BaseModel.fromJSONObject(
+      json,
+      TeamComplianceSetting,
+    );
+
+    expect(setting.ruleType).toBe(ComplianceRuleType.HasIncidentOnCallRules);
+    expect(setting.notificationChannel).toBe(
+      ComplianceNotificationChannel.Call,
+    );
+    expect(setting.incidentSeverities).toHaveLength(2);
+    for (const severity of setting.incidentSeverities || []) {
+      expect(severity).toBeInstanceOf(IncidentSeverity);
+    }
+    expect(
+      (setting.incidentSeverities || []).map(
+        (severity: IncidentSeverity): string | undefined => {
+          return severity._id;
+        },
+      ),
+    ).toEqual([
+      "c1c1c1c1-0000-4000-8000-000000000001",
+      "c1c1c1c1-0000-4000-8000-000000000002",
+    ]);
+    expect(setting.alertSeverities).toEqual([]);
+
+    const back: JSONObject = BaseModel.toJSONObject(
+      setting,
+      TeamComplianceSetting,
+    );
+
+    expect(back["notificationChannel"]).toBe(
+      ComplianceNotificationChannel.Call,
+    );
+    expect(
+      (back["incidentSeverities"] as Array<JSONObject>).map(
+        (severity: JSONObject): unknown => {
+          return severity["_id"];
+        },
+      ),
+    ).toEqual([
+      "c1c1c1c1-0000-4000-8000-000000000001",
+      "c1c1c1c1-0000-4000-8000-000000000002",
+    ]);
+  });
+
+  test("a cleared channel is sent as null, and stays null", () => {
+    const setting: TeamComplianceSetting = BaseModel.fromJSONObject(
+      {
+        ruleType: ComplianceRuleType.HasAlertOnCallRules,
+        notificationChannel: null,
+      },
+      TeamComplianceSetting,
+    );
+
+    expect(setting.notificationChannel).toBeNull();
+  });
+});

package/Tests/Server/API/AIChatRouteAuthorization.test.ts

@@ -17,6 +17,7 @@ import {
 import PositiveNumber from "../../../Types/PositiveNumber";
 import LlmProviderService from "../../../Server/Services/LlmProviderService";
 import ProjectService from "../../../Server/Services/ProjectService";
+import { AI_DISABLED_MESSAGE } from "../../../Server/Services/AIService";
 import {
   ExpressRequest,
   ExpressResponse,
@@ -1106,3 +1107,60 @@ describe("POST /ai-chat/send-message page context contract", () => {
     );
   });
 });
+
+/*
+ * Ask AI refuses a turn on a project with AI switched off using the SAME
+ * sentence as every other AI surface (AIService.AI_DISABLED_MESSAGE), so
+ * the chat, Slack, runbook steps and "Generate with AI" all name the one
+ * settings page that turns AI back on.
+ */
+describe("POST /ai-chat/send-message on a project with AI switched off", () => {
+  beforeEach(() => {
+    withProps(memberOfVictimProject());
+    jest
+      .spyOn(AIRunService, "countBy")
+      .mockResolvedValue(new PositiveNumber(0));
+    jest
+      .spyOn(AIRunService, "create")
+      .mockResolvedValue(new AIRun(ObjectID.generate()));
+    jest.spyOn(AIRunService, "findBy").mockResolvedValue([]);
+    jest
+      .spyOn(AIConversationService, "create")
+      .mockResolvedValue(new AIConversation(CONVERSATION_ID));
+    jest.spyOn(AIConversationService, "updateOneById").mockResolvedValue(1);
+    jest
+      .spyOn(AIConversationMessageService, "create")
+      .mockResolvedValue(new AIConversationMessage(MESSAGE_ID));
+    jest.spyOn(ChatAgentRunner, "runTurn").mockResolvedValue(undefined);
+    jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue(projectWithAI(false));
+  });
+
+  test("refuses with the shared kill-switch sentence, before a conversation or run is created", async () => {
+    const call: RouteCall = await callRoute({
+      uri: "/ai-chat/send-message",
+      body: { content: "What changed?" },
+    });
+
+    expect(call.thrown).toBeInstanceOf(BadDataException);
+    expect((call.thrown as BadDataException).message).toBe(AI_DISABLED_MESSAGE);
+    expect(AIConversationService.create).not.toHaveBeenCalled();
+    expect(AIRunService.create).not.toHaveBeenCalled();
+    expect(ChatAgentRunner.runTurn).not.toHaveBeenCalled();
+  });
+
+  test("negative control: the same turn goes through with AI on", async () => {
+    jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue(projectWithAI(true));
+
+    const call: RouteCall = await callRoute({
+      uri: "/ai-chat/send-message",
+      body: { content: "What changed?" },
+    });
+
+    expect(call.thrown).toBeUndefined();
+    expect(ChatAgentRunner.runTurn).toHaveBeenCalledTimes(1);
+  });
+});

package/Tests/Server/API/AIGenerationProjectAIToggle.test.ts

@@ -95,7 +95,7 @@ jest.mock("../../../Server/Utils/Response", () => {
 });
 
 const AI_DISABLED_MESSAGE: string =
-  "AI features are disabled for this project. Enable them in Project Settings > AI Credits.";
+  "AI features are disabled for this project. Enable them in Project Settings → AI Features.";
 
 // The project that owns the incident / alert / maintenance being generated for.
 const PROJECT_ID: ObjectID = new ObjectID(

package/Tests/Server/API/AIInvestigationAPI.test.ts

@@ -13,6 +13,10 @@ import {
   toPanelClusterAccess,
 } from "../../../Server/API/AIInvestigationAPI";
 import Runner from "../../../Models/DatabaseModels/Runner";
+import KubernetesAiAgent from "../../../Models/DatabaseModels/KubernetesAiAgent";
+import KubernetesAiAgentService from "../../../Server/Services/KubernetesAiAgentService";
+import RunnerService from "../../../Server/Services/RunnerService";
+import logger from "../../../Server/Utils/Logger";
 import KubernetesClusterService from "../../../Server/Services/KubernetesClusterService";
 import KubernetesCluster from "../../../Models/DatabaseModels/KubernetesCluster";
 import Permission, { UserPermission } from "../../../Types/Permission";
@@ -168,6 +172,8 @@ function clusterAccessStatus(): KubernetesClusterAiAccessStatus {
       key: RUNNER_KEY,
     } as KubernetesClusterAiAccessStatus["runner"],
     accessMethod: "credential",
+    aiAgent: null,
+    automaticInvestigation: { incidents: false, alerts: false },
     credentialId: CREDENTIAL_ID,
     credentialName: "prod-sa-token",
     kubectlAllowlist: ["kubectl rollout restart deployment/*"],
@@ -1375,6 +1381,8 @@ describe("AIInvestigationAPI latest-investigation cluster access", () => {
       runner: {
         id: RUNNER_ID,
         name: "kubernetes-agent/prod-us",
+        // A summary without a kind is a Runner (the documented default).
+        kind: "runner",
         isOnline: true,
         lastAliveAt: "2026-09-14T18:00:00.000Z",
         canRunAiCommands: true,
@@ -2320,61 +2328,131 @@ describe("toPanelClusterAccess gap next steps", () => {
   });
 
   /*
-   * A contract with the service rather than a fixture: the gap the real
-   * KubernetesClusterAiAccessService builds for a registered but unbound
-   * agent Runner never reaches a restricted viewer's row with the Runner's
-   * name in it.
+   * A contract with the service rather than a fixture: the gaps the real
+   * KubernetesClusterAiAccessService builds name details a viewer who may
+   * not read the cluster is not shown — the previous in-cluster Runner's
+   * name, the Kubernetes AI agent's namespace — and never reach such a
+   * viewer's row.
    */
-  it("strips the Runner name from the service's own no_runner_bound gap", async () => {
-    const service: {
-      findAgentRunnerForCluster: (
-        cluster: KubernetesCluster,
-      ) => Promise<Runner | null>;
-      getRunnerPresence: (runner: Runner) => { isOnline: boolean };
-      getNoRunnerBoundGap: (
-        cluster: KubernetesCluster,
-      ) => Promise<KubernetesAiAccessGap>;
-    } = KubernetesClusterAiAccessService as unknown as {
-      findAgentRunnerForCluster: (
-        cluster: KubernetesCluster,
-      ) => Promise<Runner | null>;
-      getRunnerPresence: (runner: Runner) => { isOnline: boolean };
-      getNoRunnerBoundGap: (
-        cluster: KubernetesCluster,
-      ) => Promise<KubernetesAiAccessGap>;
-    };
-    const agentRunner: Runner = new Runner(new ObjectID(RUNNER_ID));
-    agentRunner.name = "kubernetes-agent/prod-us-identifier";
-    const findAgentRunner: SpyInstance<
-      (cluster: KubernetesCluster) => Promise<Runner | null>
-    > = jest
-      .spyOn(service, "findAgentRunnerForCluster")
-      .mockResolvedValue(agentRunner);
-    const presence: SpyInstance<(runner: Runner) => { isOnline: boolean }> =
-      jest.spyOn(service, "getRunnerPresence").mockReturnValue({
-        isOnline: true,
-      });
+  it("strips what the service's own gaps name from a restricted row", async () => {
+    jest.spyOn(logger, "error").mockImplementation((): void => {
+      return undefined;
+    });
+    const agentLookup: SpyInstance<
+      typeof KubernetesAiAgentService.findForCluster
+    > = jest.spyOn(KubernetesAiAgentService, "findForCluster");
+    const runnerLookup: SpyInstance<typeof RunnerService.findOneBy> =
+      jest.spyOn(RunnerService, "findOneBy");
+
+    const cluster: KubernetesCluster = new KubernetesCluster(
+      new ObjectID(CLUSTER_ID),
+    );
+    cluster.projectId = new ObjectID(PROJECT_ID);
+    cluster.clusterIdentifier = "prod-us";
+    cluster.isAiInvestigationEnabled = true;
 
     try {
-      const gap: KubernetesAiAccessGap = await service.getNoRunnerBoundGap(
-        new KubernetesCluster(new ObjectID(CLUSTER_ID)),
-      );
+      // An offline agent whose namespace names the team that runs it.
+      agentLookup.mockResolvedValue({
+        id: new ObjectID(RUNNER_ID),
+        connectionStatus: "connected",
+        lastAliveAt: new Date("2026-01-01T00:00:00.000Z"),
+        posture: {
+          inCluster: true,
+          clusterIdentifier: "prod-us",
+          podNamespace: "payments-team-agent-namespace",
+        },
+      } as unknown as KubernetesAiAgent);
+
+      const agentStatus: KubernetesClusterAiAccessStatus =
+        await KubernetesClusterAiAccessService.getStatusForClusterModel({
+          cluster,
+          gates: {
+            isAiEnabled: true,
+            isAutoRemediationEnabled: true,
+            isAiCommandExecutionEnabled: true,
+            hasLlmProvider: true,
+          },
+        });
 
       // The service's text does name it...
-      expect(gap.nextStep).toContain("kubernetes-agent/prod-us-identifier");
-
-      const restricted: InvestigationPanelClusterAccess = toPanelClusterAccess(
-        statusWithGaps([gap]),
-        { canReadCluster: false, canReadCredentials: false },
+      expect(JSON.stringify(agentStatus.gaps)).toContain(
+        "payments-team-agent-namespace",
       );
-
       // ...and the restricted row does not.
-      expect(JSON.stringify(restricted)).not.toContain(
+      expect(
+        JSON.stringify(
+          toPanelClusterAccess(agentStatus, {
+            canReadCluster: false,
+            canReadCredentials: false,
+          }),
+        ),
+      ).not.toContain("payments-team-agent-namespace");
+
+      // The previous in-cluster Runner, bound and offline, by name.
+      agentLookup.mockResolvedValue(null);
+      const legacyRunner: Runner = new Runner(new ObjectID(RUNNER_ID));
+      legacyRunner.name = "kubernetes-agent/prod-us-identifier";
+      legacyRunner.hostInfo = {
+        kubernetes: {
+          inCluster: true,
+          clusterIdentifier: "prod-us-identifier",
+        },
+      };
+      runnerLookup.mockResolvedValue(legacyRunner);
+      cluster.aiAccessRunnerId = new ObjectID(RUNNER_ID);
+      cluster.clusterIdentifier = "prod-us-identifier";
+
+      const runnerStatus: KubernetesClusterAiAccessStatus =
+        await KubernetesClusterAiAccessService.getStatusForClusterModel({
+          cluster,
+          gates: {
+            isAiEnabled: true,
+            isAutoRemediationEnabled: true,
+            isAiCommandExecutionEnabled: true,
+            hasLlmProvider: true,
+          },
+        });
+
+      expect(JSON.stringify(runnerStatus.gaps)).toContain(
         "kubernetes-agent/prod-us-identifier",
       );
+      expect(
+        JSON.stringify(
+          toPanelClusterAccess(runnerStatus, {
+            canReadCluster: false,
+            canReadCredentials: false,
+          }),
+        ),
+      ).not.toContain("kubernetes-agent/prod-us-identifier");
     } finally {
-      findAgentRunner.mockRestore();
-      presence.mockRestore();
+      jest.restoreAllMocks();
     }
   });
+
+  it("carries the target's kind to the panel, so it can name the Kubernetes AI agent", () => {
+    const status: KubernetesClusterAiAccessStatus = clusterAccessStatus();
+    status.runner = {
+      ...status.runner!,
+      name: "Kubernetes AI agent",
+      kind: "ai_agent",
+    };
+
+    const row: InvestigationPanelClusterAccess = toPanelClusterAccess(status, {
+      canReadCluster: true,
+      canReadCredentials: true,
+    });
+
+    expect(row.runner?.kind).toBe("ai_agent");
+    expect(row.runner?.name).toBe("Kubernetes AI agent");
+  });
+
+  it("gives the out-of-credits gap the project-settings step", () => {
+    expect(getRestrictedGapNextStep("ai_balance_insufficient")).toBe(
+      RESTRICTED_PROJECT_GAP_NEXT_STEP,
+    );
+    expect(RESTRICTED_GAP_NEXT_STEP).toContain(
+      "the cluster's AI agent page (AI → Agent)",
+    );
+  });
 });